@homebridge/ciao
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:pino | AI (typosquat): @homebridge/ciao is a legitimate scoped mDNS/DNS-SD library under the homebridge org; Levenshtein match to 'pino' is a false positive with no relationship between the packages. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process is legitimately used in NetworkManager.js to query OS network interfaces, which is standard and expected for an mDNS library. | ai |
Versions (showing 8 of 8)
| Version | Deps | Published |
|---|---|---|
| 1.3.9 | 4 / 13 | |
| 1.3.8 | 4 / 13 | |
| 1.3.7 | 4 / 13 | |
| 1.3.6 | 4 / 13 | |
| 1.3.5 | 4 / 13 | |
| 1.3.4 | 4 / 13 | |
| 1.3.3 | 4 / 13 | |
| 1.3.2 | 4 / 13 |
v1.3.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1.3.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.